Data:
- LLMs are killing the planet
- LLMs are raising utility prices
- LLMs are raising computer prices
- LLMs give you teh dums
- LLMs show negligible increases in net productivity
- LLM costs are going up
- LLMs run on stolen content
- LLM companies keep breaking laws and saying, "Oopsie!"
Open Source maintainers for some reason:
- We are debating our AI policy, but it's a tough decision. *whines*
Dudes. WTF is wrong with you?
@EdCates
"Dudes. WTF is wrong with you?"
Assuming this isn't rhetorical, and for anyone else confused:
For many larger FOSS projects you can follow the funding sources for the answer. For smaller projects it is likely just more of the psychosis caused by industrial and nation-state scale gaslighting paired with defensive hype by the overwhelming amount of new and wannabe devs trying to pump their egos while skipping the learning curve.
@RadicalEcologist @EdCates a bunch of "ideas guys" getting told they finally don't even need to interface with movers & shakers at all anymore, or ever again! lmao.
@RadicalEcologist @EdCates I use AI for some things, and I respect the hell out of people who are avoiding it.
But as a user of tons of open-source software I worry that the avoidance of AI in the OSS world, even for threat review, is going to ultimately lead to less secure software.
The robots have already proven they can out-hack humans 100 to one. It’s only a matter of time till the bad guys get ahead of Python, Git, Apache, the Linux kernel, and all the other foundations open source is built on.
@jimmylittle
I normally don't engage, but I am putting things for the record here.
Caveat: I am only discussing generative large language models. I will call them genllm for clarity.
You claim a fear that avoidance of genllm will lead to less secure software. I assume you claim this from one or both of two positions commonly held inthese discussions. One, genllm are better able to identify security flaws than humans. Two, genllm are better at writing secure code. I contest one becuase 'better', besides being subjective, is being defined by the companies profiting who make unverified claims at a pace that people without billion dollar budgets struggle to contest, though we often prove them as fraud. Regardless of success, if we look at cost, paying humans the amount it cost to generate every actual security flaw identified, I would contest it would have been cheaper than the true material and energy costs of genllm. I contest two because I know how this technology works and it can only reproduce code to the quality of the lowest common denominator of the code it was trained on, which was written by humans, and the input from the prompt, also written by humans. These models do not understand anything, they just reproduce likely results based on human work, with no comprehension of why.
These aren't sentient beings, they have not beaten humans at anything cost for cost, and it is no more dangerous than script kiddies have always been. This tech, from a security perspective, is as dangerous as any script kiddie would be when subsidized with nation-state scale budgets.
In short, your comment is the defensive hype and gaslit psychosis I was referring to. I mean that not as an insult, we humans are all vulnerable to such things, but as a blunt and honest plead that you reassess your perspective through a more objective lense.
@RadicalEcologist @EdCates You are absolutely correct on all of this. I just want to clarify that I didn’t want to imply that LLM coding is better or cheaper - just that it’s faster and doesn’t sleep.
There will come a time (it may already be here) where even the most brilliant and dedicated team of humans just won’t be able to keep up with all the vulnerabilities the agents can find.
@jimmylittle
First for all, you responded suspiciously quickly for a human. Second, you claim that it is inevitable that there will be a time where X, without any supporting evidence. I am very tired of this and will ask for you to provide evidence from an uninvested source that this tech has A: operated at some claimed level of X and B: is getting better at that claimed level of X.
You also skipped over the cost for time fallacy. Per dollar, are genllms out performing human teams? One can always compare apples and oranges and claim they produced more eggs. However, we have real metrics, like prorated materials and energy per vulnerability for humans vs genllms, and you'll note a lack of reporting on that. Consider the implications of why such statistics are being hidden before rapid replying again.
@EdCates
@jimmylittle @RadicalEcologist @EdCates They cannot. This is a misunderstanding of what they're doing. I tend to agree that fully *ignoring* LLM-generated reports is unfortunately difficult given the adversarial nature of this sort of bug reporting, which is why our quite strict policy still makes a specific allowance for this https://docs.twisted.org/en/latest/development/ai-policy.html
but it is just wrong on a bunch of levels to say that they can "out-hack humans 100 to one"
@glyph @RadicalEcologist @EdCates Humans are brilliant, but the machine is tireless. Vulnerabilities in OpenSSL, Ghostscript, OpenSC, FreeBSD, ffmpeg, and tons of other OSS have been found recently. These security flaws have been around for decades, and humans (or human-authored fuzz tests) never found them. The AI did - not because it’s better at finding them than people are, but because it’s easy to point the machine at a code base and let it churn. A person just isn’t going to do that.
@jimmylittle @RadicalEcologist @EdCates the claims are massively overstated.
from April:
more recently:
https://www.darkreading.com/application-security/mythos-vulnerability-firehose-hits-human-bottleneck
@jimmylittle @RadicalEcologist @EdCates Even if they could really find this many vulns, the issue remains as to whether they can actually do it any more cost-effectively than simply hiring tons of security researchers. It seems quite consistent with the facts we currently have, that they are burning investor cash to demonstrate that a non-competitive product *can* do a job, worse and more expensively than a person.
@jimmylittle @RadicalEcologist @EdCates If you gave me two trillion dollars in VC money, I could demo my very scary "Just Hire Some Folks™" proprietary technology of just hiring some security researchers, and then telling them to hack something. They could do it considerably more energy-efficiently than AI! If I can have unlimited funding forever, I could sure discover a lot of vulns!
@glyph @RadicalEcologist @EdCates I absolutely agree.
But I’m pragmatic. The fact is nobody is spending trillions on security researchers, they’re spending trillions on LLMs.
And the army fighting that is mostly open-source foundations and volunteers struggling to keep up.
Back to my original post - that’s my worry. There is a massive imbalance, both in sheer numbers and financial backing, between the offense and the defense.
@jimmylittle @RadicalEcologist @EdCates To some extent I share this concern and it's why we have that aforementioned carve-out. But several months into this vulnpocalypse, while it's not *nothing* (you can look at Apple's patch manifests to see that there are indeed places, especially in low-level memory-unsafe projects, where an unusually high rate of fixes is happening) the overall gestalt is not nearly as bad as it's been pitched to be.
@jimmylittle @RadicalEcologist @EdCates As someone hit by some of the smaller outlying slop waves, the majority of the vulnerabilities are like… technically valid, but they're not going to get you RCE. It's like the ReDOS wave we saw a few years ago. Ultimately a lot of this stuff is barely worth fixing, and Anthropic itself has to do a *ton* of post-finding vetting for Glasswing just to make sure the results are actually valid *at all* and not just a waste of time.
@jimmylittle @RadicalEcologist @EdCates there are massive sustainability problems here, I'm not saying there are no problems (I spend most of my waking hours thinking about the problems at this point, against my will, which is itself a problem) but the problem is not "we're all gonna get hacked"
@glyph @jimmylittle @RadicalEcologist @EdCates Can I please copy your AI policy for my projects ? It's clear, concise and covers the points I'm interested in
@Poslovitch @jimmylittle @RadicalEcologist @EdCates Yes, feel free; it's under the MIT license like everything else in the project. In fact I'd really like to set up a separate website with its own domain name and branding for this policy, since I suspect you're not the only project wanting to do this
@EdCates You might want to join https://fuckaifoundation.org
@parsingphase @EdCates @Gargron not a senior developper but I have a lot of senior coders who were praising the quality of AI code
Oct 13, 2026, 1:16 AMSo many anti-ai people. And yet, I don't know any engineers that don't use it. Possibly because they're now unemployable? 🤷
Oct 13, 2026, 4:32 AM
@EdCates Ive seen some arguments about how AI block rules are stupid becouse you cant know if AI is used in some cases and whatever.
But thats just stupid becouse like should you get rid of laws if you cant always know if someone breakes them? Or any rules in general! Its clearly about the message that we do not want AI slop here!
So in my mind if ure not against AI ure kinda for it.
@cliffordheath @EdCates You can call it whatever you want.
@cliffordheath @joonq @EdCates It is a rule and it can be enforced. If we find someone using AI, we ban them. Usually it's easy because they won't stop talking about it, and if they don't do that, they do stupid things that give it away like leaving conversational replies from the chatbot in their writeups they copy and paste.
What you mean to say is that you can't know you've caught 100% of AI users. Guess what? You can't catch 100% of murderers either. But that doesn't mean "don't murder people" isn't a "rule".
Oct 13, 2026, 6:30 AM@EdCates dudes loves a good obedient coding slave and laziness is easy.
@EdCates I keep hearing the excuse of: "we are a small team we can't keep up with the fixes and bug reports" and to a certain degree I see their point BUT... That's the core of open source tho? It was never meant to put out a perfect product or solution!!! It was meant for everyone to COLLABORATE towards a solution... You're taking that core element out of the whole foundation of open source. The same way AI took the process and hard work from art.
As in everything there is not just black and white but damn it feels bad to see projects go closed source because of AI or the opposite fully embrace the slop.
Oct 13, 2026, 1:25 PM@EdCates a bunch of developers are deeply AI brained. Even good ones, they've fallen for the pied Piper of the next awesome you have to use it, it's amazing, use it or you'll be living in front of a train station by spring
